Example of one way of how Telia Company has done rush publish

Jenkinsfile rush publish step

stage('Deploy: rush version + publish to npm') {
                sshagent(credentials: ['jenkins']) {
                    if(SHALLOW_CLONE) {
                        // we need to "unshallow" the git repo for rush publishing/verification purposes
                        sh "git fetch --unshallow"
                    }

                    if("$BRANCH_NAME" == "master") {
                        // We are on the master branch, so publish the projects from rush.json

                        // rush needs this to use git when publishing
                        sh "git config user.email '[email protected]'"
                        sh "git config user.name 'Jenkins'"

                        // rush needs this to use git when publishing
                        withCredentials([usernamePassword(credentialsId: 'abc', passwordVariable: 'abc', usernameVariable: 'abc')]) {
                            // we keep this to set up the registry values and misc. things, but true authentication is done in the next step
                            sh "curl -u${username}:${password} \"https://abc/npm/auth\" >> ~/.npmrc"
                        }

                        // rush bumps versions of all relevant packages, then go back to the branch in question and pull the pushed changes
                        sh 'node common/scripts/install-run-rush.js --debug version --bump --version-policy="CI" --target-branch $BRANCH_NAME'
                        sh 'git checkout $BRANCH_NAME'
                        sh 'git pull'

                        // rush publishes the packages.
                        sh "node common/scripts/install-run-rush.js --debug publish --apply --publish --tag latest --include-all --target-branch $BRANCH_NAME --add-commit-details"

                        // after publishing, we are guaranteed to be ok with the rush change step.
                        rushChangeVerifyOk = true
                    } else {
                        // if we are not on master, do a rush change --verify to check if we are missing changelogs
                        echo "performing `rush change --verify`. If this fails, the build will fail at the end, after the deploy step, because we want to block PR's that don't fulfil this requirement."
                        def error = sh (
                            script: "node common/scripts/install-run-rush.js --debug change --verify",
                            returnStatus: true
                        )

                        if(error == 0) {
                            rushChangeVerifyOk = true
                        } else {
                            rushChangeVerifyOk = false
                        }
                    }
                }
            }